@codacy/verity-cli 0.26.0-experimental.d7dfc00 → 0.26.0-experimental.fb8a404

package/bin/verity.js

@@ -10474,10 +10474,9 @@ var SECURITY_PATTERNS = [
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
 var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
-var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
+var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var GITHUB_OAUTH_SCOPES = "repo user:email";
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10761,7 +10760,7 @@ async function githubDeviceFlow() {
     const res = await fetch(GITHUB_DEVICE_CODE_URL, {
       method: "POST",
       headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
-      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
+      body: form({ client_id: GITHUB_CLIENT_ID })
     });
     if (!res.ok) {
       return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
@@ -11100,7 +11099,6 @@ async function registerProject(opts) {
       CREDENTIALS_FILE,
       `token: ${token}
 service_url: ${service_url}
-provider_token: ${providerToken}
 `,
       { mode: 384 }
     );
@@ -11117,7 +11115,6 @@ provider_token: ${providerToken}
     await (0, import_promises3.appendFile)(
       GLOBAL_CREDENTIALS_FILE,
       `${opts.remote} token: ${token}
-${opts.remote} provider_token: ${providerToken}
 `,
       { mode: 384 }
     );
@@ -17083,7 +17080,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.d7dfc00").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.fb8a404").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-setup/SKILL.md

@@ -346,13 +346,15 @@ verity auth verify
   verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
   ```
 
-  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
+  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub App
   **device flow** ("open https://github.com/login/device and enter code
   WXYZ-1234"), proving the user has **write access** to the repo before the
-  service issues a token.
+  service issues a token. The GitHub App requests only read-only permissions
+  (Metadata + Email addresses); the resulting token is used once server-side to
+  check repo access and is never persisted.
 
-When authenticated, `.verity/credentials` contains `token`, `service_url`, and
-`provider_token` — all subsequent `verity` upload commands work.
+When authenticated, `.verity/credentials` contains `token` and `service_url` —
+all subsequent `verity` upload commands work.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.26.0-experimental.d7dfc00",
+  "version": "0.26.0-experimental.fb8a404",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {